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THE UNITED STATES PATENT AND TRADEMARK OFFICE 

Applicant: J. Rosenberger Attorney Docket No. : WIMET- 1-21 663 

Application No.: 10/669,124 Group Art Unit: 2171 

Filed: September 23, 2003 Examiner: S. Metjahic 

Title: SYSTEM AND METHOD FOR WIRELESS LOCAL AREA NETWORK 

OPERATIONAL MONITORING AND INTRUSION DETECTION 

RENEWED PETITION TO MAKE SPECL\L UNDER 37 C.Y.R. S L102 

Seattle, Washington 98101 

July 20, 2005 

TO THE COMMISSIONER FOR PATENTS: 

Applicant requests reconsideration that the above-identified application be made special 
and examination accelerated according to 37C.F.R. § 1.1 02(d), In this renewed petition, 
apphcant has perfected the omission to elect without traverse as identified by the Special 
Programs Examiner in a communication on this matter dated July 5, 2005. Applicant submits 
that the present application, with this renewed petition, meets the requirements set forth in the 
M.P.E.P. § 708.02(Vni). 

hi regard to M.P.E.P. § 708.02(VIII)(A), the fee set forth in 37 C.F.R. § LI 7(h) was 
included with the original Petition to Make Special. 

In compUance with M.P.E.P. § 708.02(Vni)(B), applicant submits that the claims of the 
present application are directed to a single invention. If it is determined that all claims presented 
are not obviously directed to a single invention, applicant will make an election without traverse. 

Consistent with M.P.E.P. § 708.02(VIII)(C), applicant submits that a pre-examination 
search has been made by the World Intellectual Property Organization (WIPO) for a PCT 
appUcation that corresponds to the present application. Copies of the Intemational Search Report 
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and Preliminary Examination Report are attached. Applicant further submits that the claims of 
the PCT application (the subject matter of the pre-examination search) are of the same or similar 

scope to the claims of the present application. 

In regard to M.P.E.P. § 708.02(Vm)(D), a copy of each reference cited in the 
International Search Report is enclosed. 

In compliance with M.P.E.P. § 708.02(VIII)(E), a detailed discussion of the references 
and how the claimed subject is patentable over the references is set forth below. 

U.S. Patent Application Publication No. 2003/0217283 AL to Hrastar et al. ("Hrastar") 

Hrastar provides a system for detecting and responding to security violations. The 
Hrastar system operates on all wireless network traffic. As a wireless network frame (wireless 
network traffic) is received, an intrusion detection system (IDS) executes a series of tests on the 
packets of information in the network frame. The tests include a signature-based test, a 
protocol-based test, an anomaly-based test, and a policy deviation-based test. 

The signatxire-based test analyzes information in the wireless network traffic to detect the 
"signature" of known secxuity threats. In this case, "signature" should be viewed as a term of art, 
referring to patterns and sequences in the data that are known security threats. As a point of 
reference, computer viruses are also commonly recognized by their "signature," i.e., the presence 
of particular sequences or patterns in data to identify it as a potential security threat/virus. 

The protocol-based test determines whether or not the protocol used in the network traffic 
is legitimate. As stated in Hrastar, emitting a large number of association or disassociation 
requests in a short interval is not a legitimate use of the protocol. 

The anomaly-based test analyzes whether the particular network activity falls outside of 
the "norm." Large transfers of data from one location to another might fall outside of the norm, 
and trigger an appropriate response. 
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The policy-based test determines whether the activity violates predetermined policies. 

Access by a particular client to a restricted subnet may constitute a policy-based violation. 

If, based on the results of the tests, unauthorized wireless network traffic is detected, the 
IDS may take appropriate action. The actions include notification of administrators, as well as 
communication measures (called active measures) designed to thwart the wireless 
connection/activity. These active measures include introducing CRC errors into the wireless 
stream, "trapping/mapping" the intruder to determine its location, introducing "chaff* into the 
wireless stream to reduce the probability that an intmder can break the system encryption, 
jamming by broadcasting noise in the spectrum such that no workstation can connect to an 
access point, dynamic channel changing, and the like. 

U.S. Patent Application PubUcation No. 2003/0217289 AL to Ammon et al. ("Ammon") 

In addition to a "regular" network that includes wireless access points, Ammon discloses 
a wireless intrusion detection system (WID system). The Ammon system includes one or more 
WID nodes and at least one WID collector. 

Purportedly, the WID nodes monitor the wireless network for both authorized and 
unauthorized access. The WID nodes periodically report events (information regarding 
unauthorized access) to the WID collector. This is reported in an out-of-band communication to 
the WID collector. The WID collector amasses the event information regarding unauthorized 
events, and makes the information available to system administrators. 

While Ammon generally references monitoring for unauthorized wireless access, little is 
discussed. Rather, Ammon appears more focused at the interaction between the WID nodes and 
the WID collector, and in reporting unauthorized access to a system administrator in various 
formats. 
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The Claims Distinguished from Hrastar and Ammon 

While both Hrastar and Ammon are generally directed to unauthorized wireless activity, 
neither of the references include the following limitations as foxmd in independent Claim 1 : 

passively monitors for network traffic received from an unknown wireless device; 

creates a device profile of the unknown wireless device; 

determines whether the unknown wireless device is an authorized device; and 

if the unknown wireless device is determined to be an authorized device, permits 
the network traffic from the unknown wireless device to pass to the computer 
network. 

Unlike the present invention, Hrastar subjects all wireless network activity to determine 
whether it is authorized/unauthorized. Li contrast, the present invention monitors for wireless 
activity from an unknown wireless device. In other words, wireless network originating from a 
known/authorized device will pass through without any obstruction or challenge. 

Neither Hrastar nor Ammon teach or suggest creating a device profile of the unknown 
device. As mentioned above, Hrastar challenges all wireless network activity, subjecting all 
traffic to a series of tests designed to detect unauthorized access. However, this is not a profile 
of the "unknown device" for at least two reasons: (1) Hrastar challenges all network traffic, not 
just unknown devices, and (2) Hrastar subjects information to tests, which is substantially 
distinct from the positive action of creating "a device profile of the unknown device." 

It follows that as Hrastar and Ammon fail to teach or suggest creating a device profile, it 
ftirther follows that the two cited references fail to teach or suggest determining whether the 
unknown wireless device is an authorized device according to the device profile. 

It also follows that cited references fail to teach or suggest permitting "the network traffic 
from the unknown wireless device to pass to the computer network" "if the unknown wireless 
device is determined to be an authorized device." 
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Conclusion 



The granting of this petition and an early Office Action on the merits of the application 
are respectfully requested. 



I hereby certify that this correspondence is being deposited with the U.S. Postal Service in a sealed 
envelope as first class mail with postage thereon fully prepaid and addressed to Mail Stop Petition, Commissioner 
for Patents, P.O. Box 1450, Alexandria, VA 22313-1450, on the below date. 



TSPiIal 

Attachments: 

International Search Report 
Cited references 

Prehminary Examination Report 



Respectfully submitted, 




Registration No. 53,479 
Direct Dial No. 206.695.1786 




LAW OFFICES OF 
CHRISTENSEN O'CONNOR JOHNSON KINDNESS''"^ 
1420 Fifth Avenue 
Suite 2800 
Seattle, Washington 98101 
206.682.8100 



WIMET\21663 RENEWED PETITI0N.DOC 



PATENT COOPERATION TREATY 



From the INTERNATIONAL SEARCHING AUTHORITY 



To: 

TRACY S. POWELL 

CHRISTENSEN O'CONNOR JOHNSON KINDNESS PLLC 
1420 FIFTH AVENUE, SUITE 2800 
SEATTLE, WA 98101 



PCX 



NOTIFICATION OF TRANSMITTAL OF 
THE INTERNATIONAL SEARCH REPORT 
OR THE DECLARATION 

(PCT Rule 44.1) 



Date of Mailing 
{day/month/year) 



Applicant's or agent's file reference 
WIMET121770 



FOR FURTHER ACTION See paragraphs 1 and 4 below 



International application No. 
PCT/US03/30839 



Applicant 

WIMETRICS CORPORATION 



International filing date 
{day/month/year) 

23 September 2003 (23.09.2003) 



^ • 12^ '^hc applicant is hereby notified that the international search report has been established and is transmitted herewith. 
Filing of amendments and statement under Articie 19: 

The applicant is entitled, if he so wishes, to amend the claims of the international application (see Rule 46): 

When? The lime limit for filing such amendments is normally two months from the date of transmittal of the 
International search report. 

Where? Direcdy to the International Bureau of WIPO, 34. chemin des Colombeites 
1211 Geneva 20, Switzerland, Facsimile No. : (41-22)740.14.35 

For more detailed instructions, see the notes on the accompanying sheet. 

The applicant is hereby notified that no international search report will be established and that the declaration under 
Article I7(2)(a) to that effect is transmitted herewith. 

3. □ With regard to the protest against payment of (an) additional fee(s) under Rule 40.2, the applicant is notified that: 

the protest together with the decision thereon has been transmitted to the International Bureau together with the 
applicant's request to forward the texts of both the protest and the decision thereon to the designated Offices. 
\^ no decision has been made yet on the protest; the applicant will be notified as soon as a decision is made. 

4. Reminders 

Shortly after 18 months from the priority date, the international application will be published by die International Bureau. If the 
applicant wishes to avoid or postpone publication, a notice of withdrawal of the international application, or of the priority claim, 
must reach the International Bureau as provided in Rules 90 bis.l and 90 bis. 3, respectively, before the completion of die technical 
preparations for international publication. 

Within 19 months from the priority date, but only in respect of some designated Offices, a demand for international preliminary 
examination must be filed if die applicant wishes to postpone the entry into die national phase until 30 months from die priority 
date (in some Offices even later); otherwise the applicant must, within 20 months from the priority date, perform the prescribed 
acts for entry into the national phase before those designated Offices. 

In respect of odier designated Offices, the time limit of 30 months (or later) will apply even if no demand is filed widiin 19 months. 

See die Annex to Form PCT/IB/301 and, for details about die applicable time limits. Office by Office, see die PCT AppUcam's 
Guide, Volume II. National Chapters and die WIPO Internet site. 



Name and mailing address of die ISA/US 
Mail Stop PCT, Atm: ISA/US 
Commissioner for Patents 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
Facsimile No. (703) 305-3230 



Form PCT/ISA/220 (April 2002) 



Authorized officer 



Telephone No. 703-305-3900 



1 ompe 
Christopher Revak 



(See notes on accompanying sheet) 
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INTERNATIONAL SEARCH REPORT 
(PCT Article 18 and Rules 43 and 44) 



Applicant's or agent's file reference 
WIMET121770 



FOR FURTHER 
ACTION 



see Notification of Transmittal of International Search 
Report (Form PCT/ISA^20) as well as, where applicable, 
item 5 below. 



International application No. 
PCT/US03/30839 



International filing date {day/moruh/year) 
23 September 2003 (23.09.2003) 



(Earliest) Priority Date {day /month/year) 
23 September 2002 (23.09.2002) 



Applicant 

WIMETRICS CORPORATION 



This international search repon has been prepared by this International Searching Authority and is. transmitted to the applicant 
according to Article 18. A copy is being transmitted to the International Bureau. 

This international search report consists of a total oi _jf sheets. 

^ It is also accompanied by a copy of each prior art document cited in this report. 



Basis of the Report 

a. With regard to the language, the international search was carried out on the basis of the international application in the 

language in which it was filed, unless otherwise indicated under this item, 
the international search was carried out on the basis of a translation of the international application furnished to this 
Authority (Rule 23. 1(b)). 

With regard to any nucleotide and/or amino acid sequence disclosed in the international application, the international 
search was carried out on the basis of the sequence listing: 
contained in the international application in written form, 
filed together with the international application in computer readable form, 
furnished subsequently to this Authority in written form, 
furnished subsequently to this Authority in computer readable form. 

the statement that the subsequently furnished written sequence listing does not go beyond the disclosure in the 
international application as filed has been furnished. 

the statement that the information recorded in computer readable form is identical to the written sequence listing has 
been furnished. 

Certain claims were found unsearchable (See Box I). 

Unity of invention is lacking (See Box II). 
With regard to the title, 

[X3 the text is approved as submitted by the applicant. 

I I the text has been established by this Authority to read as follows: 



□ 



□ 
□ 
□ 
□ 
□ 

□ 

□ 
□ 



With regard to the abstract, 

I I the text is approved as submitted by the applicant. 

the text has been established, according to Rule 38.2(b), by this Authority as it appears in Box HI. The applicant may, 
within one month from the date of mailing of this international search report, submit conunents to this Authority. 



The figure of the drawings to be published with the abstract is Figure No. 2 

[/Kl as suggested by the applicant. 

I I because the applicant failed to suggest a figure. 

I I because this figure better characterizes the invention. 



□ 



None of the figures 



Form PCT/ISA/210 (first sheet) (July 1998) 



INTERNATIONAL SEARCH REPORT 



International application No. 
PCTAJS03/30839 



Box lU TEXT OF THE ABSTRACT (Continuation of Item 5 of the first sheet) 



The technical features mentioned in the abstract do not include a reference sign between parentheses (POT Rule 8.1(d)). 
NEW ABSTRACT 

The present invention provides a system and method for providing real-time wireless network (200) monitoring and intrusion 
detection (202). The present invention profiles wireless devices (134) and maintains a database of known/authorized wireless device 
profiles (134). Wireless devices (134) are analyzed to determine the threat level they pose to the network (110), and if the threat 
level exceeds a predetermined threshold, the invention refuses to bridge the network traffic from the wireless devices (134) to the 
wired network (1 10). The present invention provides reponing of the wireless activity, the known and unknown wireless devices 
(134), and the threat levels posed by the wireless devices (134). If an unknown wireless device is determined to be', or may be, a 
wireless access point, an alert is generated, such as notifying a system administrator to take appropriate action. 
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INTERNATIONAL SEARCH REPORT 



International application No. 
PCT/US03/30839 



A. CLASSIFICATION OF SUBJECT MATTER 

IPC(7) : H04L 9/00, 9/32; G06F 11/30, 12/14. 15/16 
US CL 380/270; 713/200, 201 , 202; 709/223. 224; 370/912, 913 

According to International Patent Classification (IPC) or to both national classification and IPC 

B. FIELDS SEARCHED 



Minimum documentation searched (classification system followed by classification symbols) 
U.S. : 380/270; 713/200. 201, 202; 709/223. 224; 370/912, 913 



Documentation searched other than minimum documentation to the extent that such documents are included in the fields searched 



Electronic data base consulted during the international search (name of data base and. where practicable, search terms used) 
Please See Continuation Sheet 



C. 



DOCUMENTS CONSIDERED TO BE RELEVANT 



Category * 



Citation of document, with indication, where appropriate, of the relevant passages 



Relevant to claim No. 



X.E 
X.E 



US 2003/0217289 Al (AMMON et al) 20 November 2003. see Abstract, paragraphs 

12,25,73,117,118, and 136 

US 2003/0217283 Al (HRASTAR el al) 20 November 2003. see paragraphs 
19,48,139,158,159, and 163 



1-66 
U66 



□ 



Further documents are listed in the continuation of Box C. 



□ 



See patent family annex. 



* Special caiegories of cited documents: 

"A' document defining the gcneraJ state of the >n which is not constdeied to be 
of particular relevance 

eariier application or patent published on or after the intemaUonal filing date 

"L" document which may throw doubUi on priority claim(s) or which is cited to 
establish the publication date of another citation or odier special reason (as 
specified) 

"O" document referring to an oral disclosure, use, exhibition or other means 

"P" document published prior to the iniemational filing date but later than the 
priority date claimed 



later document published after the iniemational filing date or priority 
date and not in conflict with the applicaticHi but cited to understand the 
principle or theory underlying the invention 

document of particular relevance; the claimed invention cannot be 
considered novel or cannot be considered to involve an inventive step 
when the document is taken alone 

document of particular relevance; the claimed invention cannot be 
considered to involve an inventive step when the document is 
combined with one or more other such documents, such combination 
being obvious to a person sicilled in the an 

documeiu member of the same patent family 



Date of the actual completion of the international search 
27 February 2004 (27.02.2004) 


Date of mailing of the international search report 

11 MAR ?nni 


Name and mailing address of the ISA/US 
Mail Slop PCT, Attn: ISA/US 
Commissioner for Patents 
P.O. Box 1450 

Alexandria. Virginia 22313-1450 
Facsimile No. (703) 305-3230 


Authorized officer j^^Uf^^tU/Uf^ . ttv*^*''^^ 
Christopher Revak 
Telephone No. 703-305-3900 



Form PCT/ISA/210 (second sheet) (July 1998) 
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Continuation of B. FIELDS SEARCHED Item 3: 
BRS (files: USPAT. DERWENT, EPO, JPO, IBMTDBs, USPGPUB) 

search terms: intrusion, intruder, attack, attacked, attacker, attacking, hostile, detect, detected, detecting. d«ection, monitor, 
monitoring, monitored, audit, audited, auditing, analyze, analyzing, analyzed, analysis, unknown, unrecognized, unrecognize, device, 
location, component, pda, node, cellular, phone, laptop, wireless, portable, authorize, authorization, authorizing, authorized, 
authenticate, authentication, authenticated, authenticating, verify, verification, verifying, verified 
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Date of Mailing 



PCX 



NOTIFICATION OF TRANSMITTAL OF 
INTERNATIONAL PRELIMINARY 
EXAMINATION REPORT 



(PCX Rule 71.1) 



1 1 MAY 2004 



Applicant's or agent's file reference' 
WIMET121770 



IMPORTANT NOTIFICATION 



International application No. 
PCT/US03/30839 



International filing date (day/month/year) 
23 September 2003 (23.09.2003) 



Priority date {day/month/year) 
23 September 2002 (23.09.2002) 



Applicant 



WIMETRICS CORPORATION 



1. The applicant is hereby notified that this International Preliminary Examining Authority transmits herewith the 
international preliminary examination report and its annexes, if any, established on the international application. 

2. A copy of the report and its annexes, if any, is being transmitted to the International Bureau for conmiunication to 
all the elected Offices. 

3. Where required by any of the elected Offices, the International Bureau will prepare an English translation of the 
report (but not of any annexes) and will transmit such translation to those Offices. 

4. R£MIND£R 

The applicant must enter the national phase before each elected Office by performing certain acts (filing 
translations and paying national fees) within 30 months from the priority date (or later in some Offices)(Article 
39(I))(see also the reminder sent by the International Bureau with Form PCT/IB/301). 

Where a translation of the international application must be furnished to an elected Office, that translation must 
contain a translation of any annexes to the international preliminary examination report. It is the applicant's 
responsibility to prepare and furnish such translation directly to each elected Office concerned. 

For further details on the applicable time limits and requirements of the elected Offices, see Volume II of the PCT 
Applicant's Guide. 



Name and mailing address of the IPEA/US 


Authorized officep-v i 1 


Mail Stop PCT, Attn: IPEA/US 


Ayaz Sheikh ('i^f^'-ff^ Co^,...^y^ 


Commissioner for Patents 


P.O. Box 1450 




Alexandria, Virginia 22313-1450 


Telephone No. 703-305-3900 


Facsimile No. (703) 305-3230 





Form PCT/IPEA/416 (July 1992) 
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(PCT Article 36 and Rule 70) 



Applicant's or agent's file reference 

WIMET121770 



FOR FURTHER ACTION 



See Notification of Transmittal of International 
Preliminary Examination Report (Form PCT/IPEA/416) 



International application No. 

PCT/US03/30839 



International filing date (day/month/year) 
23 September 2003 (23.09.2003) 



Priority date (day/month/year) 
23 September 2002 (23.09.2002) 



International Patent Classification (IPQ or national classification and IPC 
IPC(7): HQ4L 9/00, 9/32; G06F 11/30, 12/14. 15/16 and US CI.: 380/270; 713/200, 201, 202; 709/223, 224; 370/912, 913 



Applicant 

WIMETRICS CORPORATION 



1 . This international preliminary examination report has been prepared by this International Preliminary 
Examining Authority and is transmitted to the applicant according to Article 36. 



2. This REPORT consists of a total of^ sheets, including this cover sheet. 

This report is also accompanied by ANNEXES, i.e., sheets of the description, claims and/or drawings 
which have been amended and are the basis for this report and/or sheets containing rectifications made 
before this Authority (see Rule 70. 16 and Section 607 of the Administrative Instructions under the PCT). 

These annexes consist of a total of sheets. 



This report contains indications relating to the following items: 
Basis of the report 



I 




II 


□ 


III 


□ 


IV 


□ 


V 




VI 


□ 


VII 


□ 


VIII 


□ 



Reasoned statement under Article 35(2) with regard to novelty, inventive step or industrial 
applicability; citations and explanations supporting such statement 



VIII □ Certain observations on the international application 



Date of submission of the demand 
29 March 2004 (29.03.2004) 



Date of completion of this report 
01 May 2004 (01.05.2004) 



Name and mailing address of the IPEA/US 
Mail Stop PCT, Attn: IPEA/US 
Commissioner for Patents 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
Facsimile No. (703) 305-3230 



Authorized officei 
Ayaz Sheikh 
Telephone No. 703-305-3900 



Form PCT/IPEA/409 (cover sheet)(July 1998) 



INTERNATIONAL PRELIMINARY EXAMINATION REPORT 



International application No. 
PCT/US03/30839 



1. Basis of the report 



With regard to the elements of the international application:* 
the international application as originally filed, 
the description: 

pages 1-19 as originally filed 

pages NONE , filed with the demand 

pages NONE , filed with the lener of 

the claims: 

pages 20-28 as originally filed 

pages NONE , as amended (together with any statement) under Article 19 

pages NONE , filed with the demand 

pages NONE , filed with the letter of 



the drawings: 

pages 1-11 as originally filed 

pages NONE , filed with the demand 

pages NONE . filed with the letter of . 

I I the sequence listing part of the description: 

pages NONE , as originally filed 

pages NONE , filed with the demand 

pages NONE , filed with the letter of . 

With regard to the language, all the elements marked above were available or furnished to this Authority in the 
language in which the international application was filed, unless otherwise indicated under this item. 
These elements were available or furnished to this Authority in the following language which is: 



□ 



the language of a translation furnished for the purposes of international search (under Ruie23.1(b)). 

I I the language of publication of the international application (under Rule 48.3(b)). 

I I the language of the translation furnished for the purposes of international preliminary examination(under Rules 
55.2 and/or 55.3). 

3. With regard to any nucleotide and/ or amino acid sequence disclosed in the international application, the 
international preliminary examination was carried out on the basis of the sequence listing: 

I I contained in the international application in printed form. 

I I filed together with the international application in computer readable form. 

I I furnished subsequently to this Authority in written form. 

I I fiimished subsequently to this Authority in computer readable form. 

I I The statement that the subsequently furnished written sequence listing does not go beyond the disclosure in the 
international application as filed has been furnished. 

I I The statement that the information recorded in computer readable form is identical to the written sequence listing 
has been furnished. 

4. I I The amendments have resulted in the cancellation of 

I I the description, pages NONE 

I I the claims, Nos. NONE 

I I the drawings, sheets/fi§ NONE 

5. I I This report has been established as if (some oO the amendments had not been made, since they have been considered to go 

beyond the disclosure as filed, as indicated in the Supplemental Box (Rule 70.2(c)).** 

* Replacement sheets which have been furnished to the receiving Office in response to an invitation under Article 14 are referred to in 
this report as "originally filed" and are not annexed to this report since they do not contain amendments (Rules 70.16 and 70.17). 
** Any replacement sheet containing such amendments must be referred to under item 1 and annexed to this report. 
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International application No. 
PCT/US03/30839 



V. Reasoned statement under Rule 66.2(a) (ii) with regard to novelty, inventive step or industrial applicability; 
citations and explanations supporting such statement 

1. STATEMENT 



Novelty (N) Claims 1:;66 YES 

Claims NONE NO 

Inventive Step (IS) Claims 1:66 YES 

Claims NONE NO 

Industrial Applicability (lA) Claims 1^:66 YES 

Claims NONE NO 



2. CITATIONS AND EXPLANATIONS 

Claims 1-66 meet the criteria set out in PCT Article 33(2)-(3), because the prior art does not teach or fairly suggest passively 
monitoring for network traffic received from an unknown wireless device, creating a device profile for the unknown wireless device, 
determining whether the unknown wireless device is an authorized device, and if the unknown wireless device is determined to be an 
authorized device, permitting network traffic from the unknown wireless device to pass to the computer network. 



NEW CITATIONS 

NONE 
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